Not sure if $taboo was getting sanitized or not. Possibly an SQL injection vulnerability that allows maliciously crafted group names to inject SQL at a later date when the group CP is loaded. Unconfirmed, theoretical fix.
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>blank_page</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
</head>
<body class="mceContentBody">
</body>
</html>